CVE-2026-33195
published 2026-03-24CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.57%
43.6th percentile
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rails | — | — |
| rails | activestorage | < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | — | — |
| rails | activestorage | — | — |
| rails | activestorage | >= 0 < 7.2.3.1 | 7.2.3.1 |
| rails | activestorage | >= 8.0.0.beta1 < 8.0.4.1 | 8.0.4.1 |
| rails | activestorage | >= 8.1.0.beta1 < 8.1.2.1 | 8.1.2.1 |
| rubyonrails | rails | < 7.2.3.1 | 7.2.3.1 |
| rubyonrails | rails | >= 8.0.0 < 8.0.4.1 | 8.0.4.1 |
| rubyonrails | rails | >= 8.1.0 < 8.1.2.1 | 8.1.2.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for blob keys containing path traversal sequences (e.g. `../`) being passed to Active Storage's DiskService#path_for method, which could indicate exploitation attempts to read, write, or delete arbitrary files outside the storage root directory. ↗
- →Monitor HTTP requests to Rails Active Storage endpoints where blob key parameters contain `../` or URL-encoded equivalents (`%2e%2e%2f`, `%2e%2e/`, `.%2e/`) that may traverse outside the configured storage root. ↗
- ·Only applications that pass user-supplied input directly as Active Storage blob keys are exploitable. Applications using internally generated, trusted blob keys are not affected. ↗
- ·The vulnerability is specific to the DiskService backend of Active Storage (local filesystem storage). Cloud-backed storage services are not impacted by this path traversal issue. ↗
- ·Patched versions are 8.1.2.1, 8.0.4.1, and 7.2.3.1. Applications running prior versions of Rails Active Storage should be prioritized for upgrade. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.0HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv8.0HIGH
vendor_debian8.0HIGH
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications
osv·2026-03-24·CVSS 8.0
CVE-2026-33195 [HIGH] CVE-2026-33195: Active Storage allows users to attach cloud and local files in Rails applications
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
GHSA
Rails Active Storage has possible Path Traversal in DiskService
ghsa·2026-03-23
CVE-2026-33195 [HIGH] CWE-22 Rails Active Storage has possible Path Traversal in DiskService
Rails Active Storage has possible Path Traversal in DiskService
### Impact
Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
### Releases
The fixed releases are available at the normal locations.
OSV
Rails Active Storage has possible Path Traversal in DiskService
osv·2026-03-23
CVE-2026-33195 [HIGH] Rails Active Storage has possible Path Traversal in DiskService
Rails Active Storage has possible Path Traversal in DiskService
### Impact
Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.
### Releases
The fixed releases are available at the normal locations.
Red Hat
Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
vendor_redhat·2026-03-23·CVSS 8.0
CVE-2026-33195 [HIGH] CWE-22 Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
Rails: Active Storage: Active Storage (Rails): Arbitrary file access via path traversal in blob keys
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
A flaw was found in Active Storage, a component of Rails applications that manages file attachments
Debian
CVE-2026-33195: rails - Active Storage allows users to attach cloud and local files in Rails application...
vendor_debian·2026·CVSS 8.0
CVE-2026-33195 [HIGH] CVE-2026-33195: rails - Active Storage allows users to attach cloud and local files in Rails application...
Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, Active Storage's `DiskService#path_for` does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. `../`) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected. Versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 contain a patch.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2chttps://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348https://github.com/rails/rails/releases/tag/v7.2.3.1https://github.com/rails/rails/releases/tag/v8.0.4.1https://github.com/rails/rails/releases/tag/v8.1.2.1https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87https://access.redhat.com/security/cve/CVE-2026-33195https://bugzilla.redhat.com/show_bug.cgi?id=2450546https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33195.json
2026-03-24
Published